b44af07de17ed16af4d6699b9462bee6855a0a0207ec787d41f00fbed81e1c13

Analysis

max time kernel
149s
max time network
150s
platform
windows10-2004_x64
resource
win10v2004-20241007-en
resource tags

arch:x64arch:x86image:win10v2004-20241007-enlocale:en-usos:windows10-2004-x64system
submitted
22/11/2024, 18:59

Sharing

Copy URL

Twitter E-mail

Report Analysis Logs

General

Target

locker.exe
Size

2.3MB
MD5

66c6dfe570b7e10fc9b62614a6bb0476
SHA1

75ca6a5a47105af2855ace988f2e86fb8d54f56a
SHA256

b44af07de17ed16af4d6699b9462bee6855a0a0207ec787d41f00fbed81e1c13
SHA512

90659304debcbe88595c469e1846ff2f8544da480dcd75ba591079eabfa8e9cca9535f8f8130114f33f5c4317a95c735c26386bbd357a9451b9af2391762db54
SSDEEP

24576:w/F1XGA9DHYdqQiF/swJ0r6ck59yjFGWG04J2ksswOGpyCP5WfWr:w91XRlYdqxF/QU5EH6wOVCBW

Score

10^/10

credential_access discovery execution ransomware spyware stealer

Malware Config

Extracted

Language

ps1

Deobfuscated

URLs

exe.dropper

https://i.imgur.com/DQ6FCxz.png

Signatures

Renames multiple (8746) files with added filename extension
This suggests ransomware activity of encrypting all the files on the system.
ransomware

Blocklisted process makes network request 1 IoCs

flow	pid	Process
34	5404	powershell.exe

Credentials from Password Stores: Windows Credential Manager 1 TTPs
Suspicious access to Credentials History.
credential_access stealer

Windows Credential Manager
T1555.004

Drops startup file 2 IoCs

description	ioc	Process
File created	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\R3ADM3.txt	locker.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Word\STARTUP\R3ADM3.txt	locker.exe

Reads user/profile data of web browsers 3 TTPs
Infostealers often target stored browser data, which can include saved credentials etc.
spyware stealer

Data from Local System
T1005

Credentials In Files
T1552.001

Credentials from Web Browsers
T1555.003

Command and Scripting Interpreter: PowerShell 1 TTPs 2 IoCs

Using powershell.exe command.

execution

PowerShell

T1059.001

pid	Process
5404	powershell.exe
5708	powershell.exe

Drops desktop.ini file(s) 31 IoCs

description	ioc	Process
File opened for modification	C:\Users\Admin\3D Objects\desktop.ini	locker.exe
File opened for modification	C:\Users\Admin\Links\desktop.ini	locker.exe
File opened for modification	C:\Users\Admin\Pictures\desktop.ini	locker.exe
File opened for modification	C:\Users\Public\Documents\desktop.ini	locker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\1033\DataServices\DESKTOP.INI	locker.exe
File opened for modification	C:\Users\Public\Desktop\desktop.ini	locker.exe
File opened for modification	C:\Users\Public\Downloads\desktop.ini	locker.exe
File opened for modification	C:\Users\Public\Libraries\desktop.ini	locker.exe
File opened for modification	C:\Users\Admin\Documents\desktop.ini	locker.exe
File opened for modification	C:\Users\Default\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	locker.exe
File opened for modification	C:\Users\Public\Music\desktop.ini	locker.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\desktop.ini	locker.exe
File opened for modification	C:\Users\Admin\Desktop\desktop.ini	locker.exe
File opened for modification	C:\Users\Admin\Contacts\desktop.ini	locker.exe
File opened for modification	C:\Users\Admin\Downloads\desktop.ini	locker.exe
File opened for modification	C:\Users\Admin\OneDrive\desktop.ini	locker.exe
File opened for modification	C:\Users\Admin\Pictures\Saved Pictures\desktop.ini	locker.exe
File opened for modification	C:\Users\Public\AccountPictures\desktop.ini	locker.exe
File opened for modification	C:\Users\Admin\Pictures\Camera Roll\desktop.ini	locker.exe
File opened for modification	C:\Users\Admin\Videos\desktop.ini	locker.exe
File opened for modification	C:\Users\Public\Pictures\desktop.ini	locker.exe
File opened for modification	C:\Program Files (x86)\desktop.ini	locker.exe
File opened for modification	C:\Users\Admin\Saved Games\desktop.ini	locker.exe
File opened for modification	C:\Program Files\desktop.ini	locker.exe
File opened for modification	C:\Users\Admin\Favorites\Links\desktop.ini	locker.exe
File opened for modification	C:\Users\Admin\Music\desktop.ini	locker.exe
File opened for modification	C:\Users\Admin\AppData\Roaming\Microsoft\Internet Explorer\Quick Launch\User Pinned\TaskBar\desktop.ini	locker.exe
File opened for modification	C:\Users\Admin\Favorites\desktop.ini	locker.exe
File opened for modification	C:\Users\Admin\Searches\desktop.ini	locker.exe
File opened for modification	C:\Users\Public\Videos\desktop.ini	locker.exe
File opened for modification	C:\Users\Public\desktop.ini	locker.exe

Sets desktop wallpaper using registry 2 TTPs 1 IoCs

ransomware

Defacement

T1491

Modify Registry

T1112

description	ioc	Process
Set value (str)	\REGISTRY\USER\S-1-5-21-1045960512-3948844814-3059691613-1000\Control Panel\Desktop\Wallpaper = "C:\\Users\\Admin\\AppData\\Local\\Temp\\Wallpaper.png"	powershell.exe

Drops file in Program Files directory 64 IoCs

description	ioc	Process
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\Personal2019R_OEM_Perp-pl.xrm-ms	locker.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Microsoft3DViewer_6.1908.2042.0_x64__8wekyb3d8bbwe\Mira.Core.Engine.winmd	locker.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Home\LTR\contrast-black\SmallTile.scale-100.png	locker.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.ZuneMusic_10.19071.19011.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\contrast-black\AppList.scale-100_contrast-black.png	locker.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_x64__8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\contrast-white\LargeTile.scale-200.png	locker.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_x64__8wekyb3d8bbwe\Assets\XboxNotificationLogo.png	locker.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\img\R3ADM3.txt	locker.exe
File opened for modification	C:\Program Files (x86)\Common Files\Microsoft Shared\ink\de-DE\TipTsf.dll.mui	locker.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\contrast-white\HxMailLargeTile.scale-125.png	locker.exe
File opened for modification	C:\Program Files\Common Files\System\ado\en-US\R3ADM3.txt	locker.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\sv-SE\tipresx.dll.mui	locker.exe
File opened for modification	C:\Program Files\Windows NT\Accessories\es-ES\R3ADM3.txt	locker.exe
File created	C:\Program Files\WindowsApps\DeletedAllUserPackages\Microsoft.WindowsCamera_2018.826.98.0_neutral_split.scale-125_8wekyb3d8bbwe\R3ADM3.txt	locker.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsAlarms_10.1906.2182.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\TimerSmallTile.contrast-black_scale-100.png	locker.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\HxA-Advanced-Light.scale-125.png	locker.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\nn\LC_MESSAGES\R3ADM3.txt	locker.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.HEIFImageExtension_1.0.22742.0_x64__8wekyb3d8bbwe\Assets\SplashScreen.scale-400.png	locker.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VCLibs.140.00.UWPDesktop_14.0.27629.0_x64__8wekyb3d8bbwe\AppxManifest.xml	locker.exe
File created	C:\Program Files\WindowsApps\Microsoft.XboxGamingOverlay_2.34.28001.0_x64__8wekyb3d8bbwe\Assets\R3ADM3.txt	locker.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\scan-files\images\themeless\Appstore\R3ADM3.txt	locker.exe
File opened for modification	C:\Program Files (x86)\Microsoft\Edge\Application\92.0.902.67\Locales\ca-Es-VALENCIA.pak	locker.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\locale\ro\LC_MESSAGES\vlc.mo	locker.exe
File created	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\AppxMetadata\R3ADM3.txt	locker.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\fr-fr\R3ADM3.txt	locker.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\combinepdf\js\nls\de-de\R3ADM3.txt	locker.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\ob-preview\js\nls\es-es\R3ADM3.txt	locker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\rsod\proofing.msi.16.en-us.boot.tree.dat	locker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\RIPPLE\R3ADM3.txt	locker.exe
File opened for modification	C:\Program Files\Mozilla Firefox\browser\features\[email protected]	locker.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxGameOverlay_1.46.11001.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\GamesXboxHubSmallTile.scale-100.png	locker.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\images\ExchangeLargeTile.scale-125.png	locker.exe
File opened for modification	C:\Program Files (x86)\Common Files\System\ado\msado28.tlb	locker.exe
File opened for modification	C:\Program Files\AssertStart.vsd	locker.exe
File created	C:\Program Files\VideoLAN\VLC\locale\lg\R3ADM3.txt	locker.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.DesktopAppInstaller_1.0.30251.0_x64__8wekyb3d8bbwe\Assets\contrast-white\AppPackageAppList.scale-100_contrast-white.png	locker.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubAppList.targetsize-64_altform-unplated.png	locker.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsFeedbackHub_1.1907.3152.0_x64__8wekyb3d8bbwe\Assets\InsiderHubSplashWideTile.scale-200.png	locker.exe
File opened for modification	C:\Program Files\dotnet\shared\Microsoft.NETCore.App\8.0.2\Microsoft.NETCore.App.deps.json	locker.exe
File created	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\System\ole db\R3ADM3.txt	locker.exe
File created	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\notetagsUI\R3ADM3.txt	locker.exe
File created	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Directions\Place\LTR\R3ADM3.txt	locker.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.XboxApp_48.49.31001.0_x64__8wekyb3d8bbwe\Assets\LiveTiles\avatar150x150.png	locker.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.BingWeather_4.25.20211.0_x64__8wekyb3d8bbwe\Assets\AppTiles\WeatherIcons\30x30\164.png	locker.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.WindowsMaps_5.1906.1972.0_neutral_split.scale-100_8wekyb3d8bbwe\Assets\SecondaryTiles\Work\contrast-black\LargeTile.scale-100.png	locker.exe
File opened for modification	C:\Program Files\WindowsApps\microsoft.windowscommunicationsapps_16005.11629.20316.0_x64__8wekyb3d8bbwe\models\appuri.ot	locker.exe
File opened for modification	C:\Program Files\WindowsPowerShell\Modules\Pester\3.4.0\Functions\TestResults.Tests.ps1	locker.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\search-summary\js\nls\uk-ua\ui-strings.js	locker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Office16\sdxs\FA000000027\assets\Icons\Send2Fluent.png	locker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\THEMES16\SKY\SKY.ELM	locker.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\app\dev\nls\da-dk\R3ADM3.txt	locker.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\on-boarding\js\nls\eu-es\R3ADM3.txt	locker.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\jre\lib\ext\sunmscapi.jar	locker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX64\Microsoft Shared\EQUATION\R3ADM3.txt	locker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\vfs\ProgramFilesCommonX86\Microsoft Shared\Web Server Extensions\16\BIN\R3ADM3.txt	locker.exe
File opened for modification	C:\Program Files\VideoLAN\VLC\lua\intf\luac.luac	locker.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Office.OneNote_16001.12026.20112.0_x64__8wekyb3d8bbwe\images\7734_32x32x32.png	locker.exe
File opened for modification	C:\Program Files\Common Files\microsoft shared\ink\fsdefinitions\main\base_rtl.xml	locker.exe
File opened for modification	C:\Program Files\Microsoft Office\root\Licenses16\O365SmallBusPremR_Subscription2-ul-oob.xrm-ms	locker.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.Windows.Photos_2019.19071.12548.0_x64__8wekyb3d8bbwe\Assets\PhotosAppList.targetsize-48_altform-unplated.png	locker.exe
File created	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\reviews\css\R3ADM3.txt	locker.exe
File opened for modification	C:\Program Files\WindowsApps\Microsoft.VP9VideoExtensions_1.0.22681.0_x64__8wekyb3d8bbwe\Assets\SmallTile.scale-150.png	locker.exe
File opened for modification	C:\Program Files (x86)\Adobe\Acrobat Reader DC\Reader\WebResources\Resource0\static\js\plugins\fss\js\nls\sk-sk\ui-strings.js	locker.exe
File opened for modification	C:\Program Files\Java\jdk-1.8\THIRDPARTYLICENSEREADME-JAVAFX.txt	locker.exe
File created	C:\Program Files\Java\jdk-1.8\jre\bin\plugin2\R3ADM3.txt	locker.exe

Drops file in Windows directory 2 IoCs

description	ioc	Process
File created	C:\Windows\R3ADM3.txt	locker.exe
File opened for modification	C:\Windows\R3ADM3.txt	locker.exe

Browser Information Discovery 1 TTPs
Enumerate browser information.
discovery

Browser Information Discovery
T1217

Suspicious behavior: EnumeratesProcesses 4 IoCs

pid	Process
5404	powershell.exe
5404	powershell.exe
5708	powershell.exe
5708	powershell.exe

Suspicious use of AdjustPrivilegeToken 2 IoCs

description	pid	Process
Token: SeDebugPrivilege	5404	powershell.exe
Token: SeDebugPrivilege	5708	powershell.exe

Suspicious use of WriteProcessMemory 8 IoCs

description	pid	Process	procid_target
PID 400 wrote to memory of 5404	400	locker.exe	95
PID 400 wrote to memory of 5404	400	locker.exe	95
PID 400 wrote to memory of 5708	400	locker.exe	98
PID 400 wrote to memory of 5708	400	locker.exe	98
PID 5708 wrote to memory of 6128	5708	powershell.exe	100
PID 5708 wrote to memory of 6128	5708	powershell.exe	100
PID 6128 wrote to memory of 6072	6128	csc.exe	101
PID 6128 wrote to memory of 6072	6128	csc.exe	101

C:\Users\Admin\AppData\Local\Temp\locker.exe
"C:\Users\Admin\AppData\Local\Temp\locker.exe"
1⤵
- Drops startup file
- Drops desktop.ini file(s)
- Drops file in Program Files directory
- Drops file in Windows directory
- Suspicious use of WriteProcessMemory
PID:400
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "(New-Object System.Net.WebClient).DownloadFile('https://i.imgur.com/DQ6FCxz.png', 'C:\Users\Admin\AppData\Local\Temp\Wallpaper.png')"
  2⤵
  - Blocklisted process makes network request
  - Command and Scripting Interpreter: PowerShell
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  PID:5404
- C:\Windows\System32\WindowsPowerShell\v1.0\powershell.exe
  powershell -Command "Add-Type -TypeDefinition 'using System; using System.Runtime.InteropServices; public class Wallpaper { [DllImport(\"user32.dll\", CharSet = CharSet.Auto)] public static extern int SystemParametersInfo(int uAction, int uParam, string lpvParam, int fuWinIni); public static void Set(string path) { SystemParametersInfo(20, 0, path, 3); } }'; [Wallpaper]::Set('C:\Users\Admin\AppData\Local\Temp\Wallpaper.png')"
  2⤵
  - Command and Scripting Interpreter: PowerShell
  - Sets desktop wallpaper using registry
  - Suspicious behavior: EnumeratesProcesses
  - Suspicious use of AdjustPrivilegeToken
  - Suspicious use of WriteProcessMemory
  PID:5708
- - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe
    "C:\Windows\Microsoft.NET\Framework64\v4.0.30319\csc.exe" /noconfig /fullpaths @"C:\Users\Admin\AppData\Local\Temp\tkmesomz\tkmesomz.cmdline"
    3⤵
    - Suspicious use of WriteProcessMemory
    PID:6128
  - - C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe
      C:\Windows\Microsoft.NET\Framework64\v4.0.30319\cvtres.exe /NOLOGO /READONLY /MACHINE:IX86 "/OUT:C:\Users\Admin\AppData\Local\Temp\RES8056.tmp" "c:\Users\Admin\AppData\Local\Temp\tkmesomz\CSC77EC6FEF6B1242AEB6FDD4D3554B523.TMP"
      4⤵
      PID:6072

Network

MITRE ATT&CK Enterprise v15

Reconnaissance

Resource Development

Initial Access

Execution

Command and Scripting Interpreter

T1059

PowerShell

T1059.001

Persistence

Privilege Escalation

Defense Evasion

Modify Registry

T1112

Credential Access

Credentials from Password Stores

T1555

Credentials from Web Browsers

T1555.003

Windows Credential Manager

T1555.004

Unsecured Credentials

T1552

Credentials In Files

T1552.001

Discovery

Browser Information Discovery

T1217

Lateral Movement

Collection

Data from Local System

T1005

Command and Control

Exfiltration

Impact

Defacement

T1491

Replay Monitor

Loading Replay Monitor...

Downloads

C:\R3ADM3.txt

Filesize
576B

MD5
f23030d9016bf550545665639ffe3329

SHA1
95195c349f6929832a1e7e3d1bd11ebfb2cbce1b

SHA256
747d06005c5539438076a0b5d3396727420aeb8c0c6348cd62324f530d0dde28

SHA512
6601c4e0af52ca5436dc12280813b0abd963a4ff1fa51af39a09d771b7898604205b74a12ad4597fa1970fc6477cae0b378887156130cf0c73a994c61924703b

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\CLR_v4.0\UsageLogs\powershell.exe.log

Filesize
2KB

MD5
2f57fde6b33e89a63cf0dfdd6e60a351

SHA1
445bf1b07223a04f8a159581a3d37d630273010f

SHA256
3b0068d29ae4b20c447227fbf410aa2deedfef6220ccc3f698f3c7707c032c55

SHA512
42857c5f111bfa163e9f4ea6b81a42233d0bbb0836ecc703ce7e8011b6f8a8eca761f39adc3ed026c9a2f99206d88bab9bddb42da9113e478a31a6382af5c220

Download Submit
C:\Users\Admin\AppData\Local\Microsoft\Windows\PowerShell\StartupProfileData-NonInteractive

Filesize
1KB

MD5
055cd1930e45c3d77aa744d53bcc29d9

SHA1
af1464daf329f36930b71fb33119c61a13472b6d

SHA256
fcd4a469c653f6bd319b201326633c2183a70184bc159c071915a9c4abd92d3c

SHA512
00ee038f281f34c7d727b7d6d7734bdfc61ee742b33edc5f905adae6afa949b9a9da8c575d949e98b24b59005e469628e99f113e0fc612dc24bbba7f098fa65d

Download Submit
C:\Users\Admin\AppData\Local\Temp\RES8056.tmp

Filesize
1KB

MD5
c3c39deca4baef1c7994382f087e1388

SHA1
d022c3e64eb9ae625302195a8e4c6ef4245ce871

SHA256
85b2f3ba07a968743297f70bbf83bbe4598ebf3a237944d7beffc84118bf7c11

SHA512
5b7eb3ded574fa9e6bd139e837ef8f8ef04fc496e6e345f82b832fdf36c7b1d72ec466ad8aed2e2fd0858b58e4b81549b4584fad4449b5749568caedfb7e31e9

Download Submit
C:\Users\Admin\AppData\Local\Temp\__PSScriptPolicyTest_l4o5mmgk.pmf.ps1

Filesize
60B

MD5
d17fe0a3f47be24a6453e9ef58c94641

SHA1
6ab83620379fc69f80c0242105ddffd7d98d5d9d

SHA256
96ad1146eb96877eab5942ae0736b82d8b5e2039a80d3d6932665c1a4c87dcf7

SHA512
5b592e58f26c264604f98f6aa12860758ce606d1c63220736cf0c779e4e18e3cec8706930a16c38b20161754d1017d1657d35258e58ca22b18f5b232880dec82

Download Submit
C:\Users\Admin\AppData\Local\Temp\tkmesomz\tkmesomz.dll

Filesize
3KB

MD5
bf2ebe2cefb910d6466369d58c0c471b

SHA1
3ea062b65eb61fe97eaca6c85fc5f4d42506a601

SHA256
fda7a82629fafcdde5813cc1ef7f3d1c5dddf85dbbe4380f7384771e7498d415

SHA512
3e5f79edbf105bbf69ba7c757c978b939935d58af0bc236fb4f5a95ed9c2ce41e875f6136797f06226b926d98118d76b40b9175ec8edaaf7307d63a5a42f6f85

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\tkmesomz\CSC77EC6FEF6B1242AEB6FDD4D3554B523.TMP

Filesize
652B

MD5
358dead0724827d624d2c21d12cb5f5f

SHA1
f4ed31268befbd138992530f29bbded7a1e3ba34

SHA256
aa356e8b4fb3bf2457c73f9bf1ea9ca5fa7e502f7d1dadd7d4708807f49204e9

SHA512
20dc8951ddf7d9d36b2b3b9abdbca46f7b8c6b1cb76b2413835c923f49b6652aeef721378683af1cd60dc47201015087179da497c37c1a35a640bf92217254ab

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\tkmesomz\tkmesomz.0.cs

Filesize
312B

MD5
945a8245afef16ce6654338c6a4b1ab7

SHA1
165014157ca311751105fdf7c7c105a1a7b113a0

SHA256
331b27fcd961cc9e94bb774dfa7e1b8c5999d91f0f820924dc7c60a6610c1246

SHA512
d598cdb315ad50340efd7c52fd31ae9aef585281c3a384d84f1def0ce9782ac324087fede7c0b1157eea9b40c0fc3cbc650f646a9c93260efcfaf7bdf962be5e

Download Submit
\??\c:\Users\Admin\AppData\Local\Temp\tkmesomz\tkmesomz.cmdline

Filesize
369B

MD5
45ce1d92c80c15af9939aef146397ce5

SHA1
31049c1d9c78c736a581010b6f5ddb259c80eb72

SHA256
81a73100f909e7a7149633eceaaae255fb4323c9b10898b697676185939948c2

SHA512
dfc48ae4fc192edda2e14b3859ab74735064ff454c7da0ff10149d6e4f066770d3333f705a8c1ca4416000cf7fcca02d530ef879d786b7375355b121e23025c2

Download Submit
memory/5404-52966-0x00007FF8CF040000-0x00007FF8CFB01000-memory.dmp

Filesize
10.8MB

Download
memory/5404-52962-0x00007FF8CF040000-0x00007FF8CFB01000-memory.dmp

Filesize
10.8MB

Download
memory/5404-52952-0x00007FF8CF040000-0x00007FF8CFB01000-memory.dmp

Filesize
10.8MB

Download
memory/5404-52951-0x000001AFC0000000-0x000001AFC0022000-memory.dmp

Filesize
136KB

Download
memory/5404-52950-0x00007FF8CF043000-0x00007FF8CF045000-memory.dmp

Filesize
8KB

Download
memory/5708-52968-0x00007FF8CF040000-0x00007FF8CFB01000-memory.dmp

Filesize
10.8MB

Download
memory/5708-52978-0x00007FF8CF040000-0x00007FF8CFB01000-memory.dmp

Filesize
10.8MB

Download
memory/5708-52980-0x00007FF8CF040000-0x00007FF8CFB01000-memory.dmp

Filesize
10.8MB

Download
memory/5708-52993-0x00000258216A0000-0x00000258216A8000-memory.dmp

Filesize
32KB

Download
memory/5708-52996-0x00007FF8CF040000-0x00007FF8CFB01000-memory.dmp

Filesize
10.8MB

Download